Question

我想获取Windows注册表中某些受保护的注册表项的上次修改时间。例如，我试图打开注册表项：

HKLM\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00\4C531001530301123274&0\Properties

使用RegOpenKeyEx但它返回error code 5，这意味着拒绝访问。

我的程序适用于不受保护的注册表项。我已禁用UAC并以＃34;以管理员身份运行＆＃34;

运行我的程序

这是我的代码：

public DateTime GetKeyModifiedTime(string computerName, string BaseKey, string SubKey)
    {
        int remoteKeyResult = -1;

        try
        {
            if (BaseKey.Equals("HKEY_LOCAL_MACHINE"))
                remoteKeyResult = RegConnectRegistry(@"\\" + computerName.ToUpper(), Convert.ToInt32(Hives.HKEY_LOCAL_MACHINE), ref longResult);
            if (BaseKey.Equals("HKEY_CURRENT_USER"))
                remoteKeyResult = RegConnectRegistry(@"\\" + computerName.ToUpper(), Convert.ToInt32(Hives.HKEY_CURRENT_USER), ref longResult);
            if (BaseKey.Equals("HKEY_USERS"))
                remoteKeyResult = RegConnectRegistry(@"\\" + computerName.ToUpper(), Convert.ToInt32(Hives.HKEY_USERS), ref longResult);


            int abasekey = 0;
            abasekey = ParseInput(BaseKey);
            //parse just the base key part and return the Integer enum value of the base key
            int BaseKeyValue = 0;
            //if the value of abasekey is not -1(used for error) then set BaseKeyValue to the returned vaue
            if (!(abasekey == -1))
            {

                BaseKeyValue = abasekey;

            }
            else
            {
                //if abasekey does = -1 then bail out because input is not correct.
            }

            int regkeyptr = 0;
            IntPtr p = new IntPtr(regkeyptr);

            int openregkeyResult = RegOpenKeyEx(longResult, SubKey, 0, KEY_QUERY_VALUE, ref p);


            //third param is Reserved and must be 0(worked as "Nothing" also)
            //strbldr.AppendLine("Open RegKey Pointer " + regkeyptr.ToString());
            // strbldr.AppendLine("Open RegKey Result " + openregkeyResult.ToString());

            //create a filetime structure to recieve the returned time
            System.Runtime.InteropServices.ComTypes.FILETIME lpftLastWriteTime = default(System.Runtime.InteropServices.ComTypes.FILETIME);

            int returnvalue = 0;

            returnvalue = RegQueryInfoKey(p.ToInt32(), null, 0, 0, 0, 0, 0, 0, 0, 0, 0, ref lpftLastWriteTime);

            //strbldr.AppendLine("RegQueryInfoKey Result " + returnvalue);
            //returnvalue is the HResult call of RegQueryInfoKey
            //strbldr.AppendLine();
            //strbldr.AppendLine("Filetime High " + lpftLastWriteTime.dwHighDateTime.ToString() + "   " + "Filetime Low  " + lpftLastWriteTime.dwLowDateTime.ToString());
            //use the api function to convert the filetime to a date time This ine returns in local time, File TIme is UTC 0 based.
            DateTime dt = FileTimeToDateTime(lpftLastWriteTime);
            return dt;


        }
        catch (Exception ex)
        {
            return DateTime.Now;

        }
    }

Answer 1

错误5是拒绝访问，如您所说。某些注册表项由系统或其他帐户拥有，并且其他所有人都被拒绝访问。如果您在注册表中转到该键，则可以查看该权限。可能它归SYSTEM所有。

Answer 2

这是因为您在KEY_QUERY_VALUE中设置了RegOpenKeyEx()。只需更改为KEY_READ。会没事的。

RegOpenKeyEx返回错误代码5

2 个答案: